Configure Device Security and Cortex XSOAR

1. Log in to Device Security and then access the Nozomi Vantage instance settings in Cortex XSOAR.

   1. Log in to Device Security and select IntegrationsIntegration ManagementManage Integrations.

      Device Security uses Cortex XSOAR to integrate with Nozomi Vantage, and the settings you must configure are in the Cortex XSOAR interface.
   2. Click Launch Cortex XSOAR.

      The Cortex XSOAR interface opens in a new browser tab or window.
   3. Click Settings in the left navigation menu to go to Integrations Instances, and search for Nozomi Vantage to locate it among other instances.
2. Configure the Nozomi Vantage integration instance.

   Configure a separate integration instance for each Nozomi deployment. For example, if you want to import data from both a Nozomi Vantage tenant and a Nozomi Guardian appliance, create one instance for each.

   1. Click the active integration instance settings icon, or click Add instance, to open the settings panel.
   2. Enter the following settings and leave the others at their default values:

      1. Name: Use the default name (Nozomi Vantage_instance_1) or enter a new one to help you identify the instance.
      2. Domain URL: Enter the URL of your Nozomi Vantage tenant or your Nozomi Guardian appliance. This value determines which Nozomi deployment Cortex XSOAR connects to.
      3. API Key Name: Enter the API Key Name that you generated in the Nozomi console.
      4. API Key Token: Enter the API Key Token that you generated together with the API Key Name.
      5. Last Seen: Enter the cutoff, in days, for retrieving vulnerabilities. Cortex XSOAR retrieves vulnerabilities seen within this number of days. The default value is 1 day.
      6. Learn New Devices: Enable this setting to automatically ingest new devices from Nozomi into Device Security. This setting is enabled by default.
      7. (Cloud-based Cortex XSOAR with Nozomi Guardian on-premises) Run on Single engine: Choose the Cortex XSOAR engine that you want to communicate with your Nozomi Guardian appliance.
   3. When finished, click Test or Test resultsRun test to test the integration instance.

      If the test is successful, a Success message appears. If not, check that the settings were entered correctly, and then test the configuration again.

   4. After the test succeeds, click Save & exit to save your changes and close the settings panel.
3. Enable the Nozomi Vantage integration instance.
4. Create a job for Cortex XSOAR to receive information from Nozomi.

   Create one job per playbook. If you have configured multiple Nozomi integration instances (for example, one for Vantage and one for Guardian), create separate jobs for each instance and playbook combination that you want to run.

   1. Click Jobs in the sidebar, and then click New Job to create a new Cortex XSOAR job.
   2. Configure the following settings in the New Job panel:

      1. Recurring: Select this if you want to periodically run the job. Clear it if you want to run the job on-demand.
      2. (Optional) Every: If you selected Recurring, enter a number and set the interval value (Minutes, Hours, Days, or Weeks) and select the days on which to run the job. If you don't select specific days, the job runs every day by default. This determines how often Cortex XSOAR queries Nozomi for information.
         You can configure Queue Handling to determine what happens if a new job starts while an old job is still running.
      3. Name: Enter a name for the job.
      4. Playbook: Select one of the following Nozomi playbooks:
         • Import Device Details From Nozomi Vantage To Device Security — imports device inventory records and their attributes.
         • Import Devices With Softwares Details From Nozomi Vantage To Device Security — imports device records together with their installed software components.
         • Import Vulnerabilities From Nozomi Vantage To Device Security — imports vulnerability findings mapped to the corresponding devices.
      5. Integration Instance Name: Enter the name of the Nozomi Vantage integration instance that you want the job to use.
5. Enable the job and run it.

   Check the Job Status for the job you created. If it's Disabled, select its checkbox and then click Enable.

   You can immediately run the job by selecting it and clicking Run now. Otherwise, if you scheduled a recurring job, then the enabled job will run as scheduled.
6. Return to Device Security and check the status of the Nozomi Vantage integration.

   An integration instance can be in one of the following four states, which Device Security displays in the Status column on the Integrations page:

   • Active — the integration was configured and enabled and is functioning properly.
   • Disabled — either the integration was configured but intentionally disabled or it was never configured and a job that references it is enabled and running.
   • Error — the integration was configured and enabled but is not functioning properly, possibly due to a configuration error or network condition.
   • Inactive — the integration was configured and enabled but no job has run for at least the past 60 minutes.

   When you see that the status of an integration instance is Active, its setup is complete.